What is the CVSS score of CVE-2026-45649?

CVE-2026-45649 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office for Android are affected by CVE-2026-45649?

A local spoofing vulnerability in Microsoft Office for Android allows attackers to manipulate trust indicators and identity information after user interaction, creating significant phishing and…

How to fix or mitigate CVE-2026-45649?

Within 24 hours: Identify all Microsoft Office for Android installations in the organization and notify users of the spoofing risk. Within 7 days: Deploy Mobile Device Management (MDM) policies restricting Office for Android use to fully-patched managed devices only; require additional authentication for sensitive document access on mobile. Within 30 days: Monitor Microsoft security advisories for patch release and prepare immediate deployment; conduct security awareness training on mobile document verification.

Microsoft Office for Android CVE-2026-45649

EUVD-2026-35693 HIGH

Improper Access Control (CWE-284)

2026-06-09 secure@microsoft.com

GHSA-4363-fqg7-xrx3

Authentication Bypass Google Microsoft Excel Powerpoint Word

7.1

CVSS 3.1 · Vendor: microsoft

Temporal: 6.2

Severity by source

Vendor (microsoft) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.2 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:02 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.1

DescriptionCVE.org

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

AnalysisAI

Local spoofing in Microsoft Office for Android lets an unauthorized attacker manipulate trust-affecting content or identity indicators after a user interacts with malicious input on the device. The CVSS 7.1 score reflects high confidentiality and integrity impact with no special privileges required, though the local attack vector and required user interaction limit remote exploitability. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

The flaw is rooted in CWE-284 (Improper Access Control), meaning Office for Android fails to correctly enforce restrictions on who can perform an action or what content can claim a given identity within the app. On Android, Office components typically rely on the platform's permission model, intent filters, content providers, and signed manifest data to mediate access between activities and documents. A CWE-284 weakness in this context generally indicates that an attacker-controlled component on the same device (another app, a crafted document, or a manipulated intent) is able to bypass intended access boundaries and present itself as something it is not - enabling the spoofing outcome called out by Microsoft. The lack of CPE data in NVD means specific affected build numbers must be retrieved directly from the Microsoft Security Response Center advisory.

RemediationAI

Patch available per vendor advisory - install the latest version of Microsoft Office for Android from the Google Play Store and consult the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45649 for the exact fixed build numbers, which are not enumerated in the public NVD data. As compensating controls until updating, restrict Office for Android to managed-app deployment via Intune or another MDM so unknown apps cannot share intents/files with it, disable opening documents from untrusted sources, and instruct users not to interact with unexpected Office prompts originating from links or files received via messaging apps. Side effects: MDM-only deployment reduces user flexibility, and blocking external file opens will break legitimate workflows that rely on sharing documents from other apps.